CVE-2026-98328 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: add HE 6 GHz capability in the scan elems len
The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scan_ies_len.
Otherwise, building probe request elements can fail, triggering the WARN_ON in __ieee80211_start_scan().
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability described involves a logic error within the Linux kernel's mac80211 wireless subsystem that affects how protocol capabilities are accounted for during network scanning operations. Specifically, the issue centers on the High Efficiency (HE) 6 GHz Band Capability element, which is part of the IEEE 802.11ax standard designed to improve performance in the 6 GHz frequency band. When a wireless device supports operation in this band, it must include specific capability elements in its probe request frames to properly negotiate connections with access points and other network entities. The flaw arises because the size of this HE 6 GHz Band Capability element was not being added to the scan_ies_len variable, which tracks the total length of information elements included in a scan or probe request frame.
This omission leads to an underestimation of the required buffer space for constructing these frames. When the kernel attempts to build and transmit a probe request that includes this capability element, the calculated size does not match the actual data being written into the buffer. This discrepancy triggers a WARN_ON assertion within the __ieee80211_start_scan function. While this specific manifestation is primarily a debugging aid rather than a direct exploitation vector for remote code execution, it indicates a significant integrity failure in memory management and protocol compliance logic. The warning serves as an indicator that the kernel has detected an inconsistency between expected and actual frame sizes, which can lead to malformed packets being transmitted or dropped by network infrastructure.
From a technical perspective, this flaw aligns with CWE-20 Improper Input Validation, as the system fails to correctly validate the size of data structures before processing them for transmission. It also relates to CWE-131 Incorrect Calculation of Buffer Size, where the allocated or expected buffer length does not accommodate all necessary components of a protocol message. In terms of adversarial tactics, this type of internal kernel inconsistency could potentially be leveraged in denial-of-service scenarios if an attacker can trigger repeated scan operations that cause these warnings to flood system logs or exhaust resources associated with handling malformed frames. It falls under the ATT&CK technique T1498 Network Denial of Service, specifically through resource exhaustion via logging or processing overhead caused by persistent kernel warnings and potential packet drops.
The operational impact of this vulnerability includes degraded wireless connectivity reliability for devices operating in the 6 GHz band. Users may experience intermittent failures when attempting to scan for networks or establish connections with HE-capable access points. Furthermore, the presence of these WARN_ON messages can clutter system logs, making it more difficult for administrators to identify other critical security events or performance issues within the kernel. In severe cases where buffer boundaries are critically mismanaged beyond just length calculation errors, there is a theoretical risk of memory corruption, although the primary symptom described here is the assertion failure rather than arbitrary code execution.
To mitigate this vulnerability, system administrators and developers must ensure that the Linux kernel is updated to include the patch that correctly adds the HE 6 GHz Band Capability element size to scan_ies_len. This fix ensures that probe request frames are constructed with accurate length fields, preventing buffer mismatches and eliminating the triggering of internal warnings. Organizations relying on high-performance wireless networks in the 6 GHz spectrum should prioritize applying this update to maintain protocol compliance and operational stability. Regular kernel updates remain the primary defense against such logic errors, as they incorporate fixes for both security vulnerabilities and functional bugs that affect system reliability.